easyMultiple ChoiceObjective-mapped
200-201 Practice Question: Sees the following event in the firewall logs:…
A network engineer sees the following event in the firewall logs: 'STATUS: intrusion prevented, action: drop, signature: "SQL Injection - SELECT"' on traffic from internal IP to a web server. What type of attack was detected?
⚠ Common exam trap
Cisco often tests the ability to distinguish between web application attacks (SQL injection vs. XSS vs. command injection) by focusing on the specific payload or signature keywords in logs, where candidates may confuse 'injection' with command injection or misinterpret the 'SELECT' keyword as a generic query rather than SQL-specific.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SQL injection
The log entry explicitly states 'SQL Injection - SELECT' as the signature, which directly identifies the attack as SQL injection. The firewall detected a malicious SQL query (e.g., a SELECT statement with crafted input) in the traffic from an internal IP to a web server and dropped it, preventing the attack. SQL injection exploits improper input validation in web applications to manipulate backend databases.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Command injection
Why it's wrong here
Command injection involves executing system commands, not SQL queries.
- ✗
Buffer overflow
Why it's wrong here
Buffer overflow exploits memory corruption, not SQL injection.
- ✗
Cross-site scripting
Why it's wrong here
XSS involves injecting scripts into web pages, not SQL.
- ✓
SQL injection
Why this is correct
The signature name directly matches SQL injection attack.
Go deeper
Related to this question
About these practice questions
This 200-201 question is part of Courseiva's 979-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.